Описание
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
Отчет
A flaw in the Konnectivity proxy-server used by hosted control planes allows a remote, unauthenticated attacker who can reach the agent-facing (cluster) endpoint to establish an agent connection without presenting a client certificate signed by the hosted cluster’s Konnectivity CA, and without using token-based agent authentication. Because that endpoint is exposed so worker agents can connect, a successful attack can enroll an untrusted agent in the routing pool. When the proxy selects that stream for a control-plane dial, the attacker may proxy, inspect, modify, or drop control-plane-to-node traffic, affecting confidentiality, integrity, and availability of that path.
Меры по смягчению последствий
Until an update that configures Konnectivity agent authentication is applied, restrict network access to the Konnectivity cluster (agent) endpoint so that only trusted worker networks can reach it. For NodePort or LoadBalancer publishing, limit ingress to port 8091 to worker node subnet ranges. For Route-based publishing, restrict access to the Konnectivity route to trusted networks where possible. These controls reduce the chance that an unauthenticated attacker can reach the agent listener; they do not replace proper agent client-certificate (or token) authentication.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Logging Subsystem for Red Hat OpenShift | openshift-logging/cluster-logging-rhel9-operator | Not affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/cluster-curator-controller-rhel9 | Not affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/hypershift-addon-rhel9-operator | Not affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/hypershift-cli-rhel9 | Not affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/managedcluster-import-controller-rhel9 | Not affected | ||
| OpenShift API for Data Protection | oadp/oadp-hypershift-velero-plugin-rhel9 | Affected | ||
| OpenShift API for Data Protection | oadp/oadp-rhel9-operator | Affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-multicluster-observability-addon-rhel9 | Not affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-must-gather-rhel9 | Not affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/endpoint-monitoring-rhel9-operator | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
9.4 Critical
CVSS3
Связанные уязвимости
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
EPSS
9.4 Critical
CVSS3